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C99shell. This program was placed on the webserver and a URL to access the program was posted on the 
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hacked, defaced, and ultimately redirected to the Anti-Scientology 
website Whyaretheydead.org. The Scientology-Europe.org website was 
modified using a program called C99shell. This program was placed 
on the webserver without the website administrator's knowledge. A 
URL to access C99Shell was posted on the messageboard 888chan.org, 
a message board frequently used by the internet group Anonymous. 
This URL provided any user who accessed the messageboard with the 
ability to modify files on the Scientology-Europe.org webserver 
without entering a username and password. 


On November 3, 2009 another Scientology website, 
Freedom-Belgium.org which is hosted on the same webserver as 
Scientology-Europe.org, logged attempts to access another version 
of the C99shell program. These logs show that several of the IP 
address who accessed the C99Shell program are located in the United 
States. 


The Scientology-Europe.org and Freedom-Belgium. org 
websites are hosted by Blue Host, out of Provo Utah. 
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On November 23, 2009 writer researched IP address 
66.35.1.170, which was logged in the attack on Scientology's 
website. Writer determined this IP address is a Tor Exit 
Router, part of the TOR Anonymity Network. As such, no 
additional information can be obtained about the person who used 
this IP address in the attack. 
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By: 


288A-LA-254389 
188B-LA-A244126-C 


Victim Contact Information 


288A-LA-254389 Serial 1 


ALL INFORELA 
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DATE 


288A-LA-254389 
usiness 
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000000000 


20091101 


OF INVESTIGATION 


Date: 


12/11/2009 


iB 
aah 
(Pending) [Ge O 


VICTIM NOTIFICATION FORM 


TON Co 


ATNED 


Q6-L3-2g0ll BY 60322 OCLP/SPLI SIN 


To: Los Angeles @... Los Angeles 
Re: 288A-LA-254389 


VWrkAddr: 
VWrkadd2: 
VWrkCity: 


VWrkSt 


VWrkCtry: 


VWrkZip 
WEmail 
WPhone 
WFax 


VicPager: 


NOKFirN 
NOKMidN 


NOKLastnN: 


NOKRel 
NOKAddr 


NOKAddr2: 


NOKCity 


NOKState: 


NOKCtry 
NOKZip 


NOKHEmal: 
NOKWEmal1: 


NOKHPho 
NOKWPho 
NOKHFax 
NOKWFax 


NOKPager: 


GrdFirN 
GrdMidN 


GrdLastn: 


GrdRel 
GrdAddr 


GrdAddr2: 
GrdCity : 
GrdState: 
GrdcCtry : 


GrdZip 


GrdHEmal: 
GrdwWEmal: 


GrdHPho 
GrdWPho 
GrdHFax 
Grdwrax 


GrdPager: 


PropRet 
TotLoss 
Lang. 

Disable 


N 
001000000 
EN 


12/11/2009 


To: Los Angeles From: Los Angeles 
Re: 288A-LA-254389 , 12/11/2009 
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(Rev. 05-01-2008) @ @ 


UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 11/04/2009 


To: Los Angeles 
Cyber 


From: Los Angeles 
CYAd 
Contact: 


Approved By: 
Drafted By: 


Case ID #: 288A-LA-254389 - 5 


ALL INFORMATION CONTAINED 

: HEREIN IS UNCLASSIFIED 

Title: SCIENTOLOGY DATE 06-13-2011 BY 60322 UCLP/PLI/IN 
UNSUB (S) 
SCIENTOLOGY -VICTIM 


Synopsis: To open and assign the above titled case. 


Details: On October 31, 2009 the scientology website 
scientology-europe.org was hacked, defaced, and ultimately 
redirected to the anti-scientology website whyaretheydead.org. 
The scientology-europe.org website was modified using a program 
called C99shell. This program was placed on the webserver 
without the website administrator's knowledge. A URL to access 
c99Shell was posted on the messageboard 888chan.org, a message 
board by the internet group Anonymous. This URL allowed any user 
who accessed the messageboard the ability to modify files on the 
scientology-europe.org webserver without entering a username and 
password. 


On November 3, 2009 another scientology website, 
Freedom-Belgium.org which is hosted on the same webserver as 
scientology-europe.org, logged attempts to access another version 
of the C99shell program. These logs show that several of the IP 
address who accessed the C99Shell program are located in the 
United States. Scientology's headquarters is located in Southern 
Disctrict of California. 


On Novermber 4, 2009, posal os the Los 
Angeles United States Attorney's ice Was contacted by writer. 


UNCLASSIFIED 


ObenE ( P4SK -LA_9S3419 “pod 


bo 
bic 


; UNCLASSIFIED 


To: Los Angeles From: Los Angeles b6 
Re: 288A-LA-254389 , 11/04/2009 bic 


avs eee to be assigned to the matter as prosecutor. 
It is requested that _this case be opened and assigned to SA 


UNCLASSIFIED 


2 


UNCLASSIFIED 
To: Los Angeles From: lLos Angeles 
Re: 288A-LA-254389 , 11/04/2009 
LEAD (s) : 


Set Lead 1: (Info) 
CYBER 
AT WASHINGTON, DC 


Read and clear. 
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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 11/06/2009 


To: Cyber atin: ssl | 
be 


From: Los Angeles b7c 
CY-1 
Contact: SA 
Approved By: 
Drafted By: joa” 
Case ID ts 288A-LA-254389 (Pending) — & 
; ALL INFORMATION CONTAINED 
Title: SCIENTOLOGY HEREIN IS UNCLASSIFIED 
UNSUB (S) DATE 06-13-2011 BY 60322 UCLPYPLI/IN 


SCIENTOLOGY-VICTIM 


Synopsis: Los Angeles hereby notifies Headquarters of a new 288A 
case. 


Details: On October 31, 2009 the Scientology website 
Scientology~Europe.org was hacked, defaced, and ultimately 
redirected to the Anti-Scientology website Whyaretheydead.org. 
The Scientology-Europe.org website was modified using a program 
called C99shell. This program was placed on the webserver 
without the website administrator's knowledge. A URL to access 
c99Shell was posted on the message board 888chan.org, a message 
board frequently used by the internet group Anonymous. This URL 
allowed any user who accessed the messageboard the ability to 
modify files on the Scientology-Europe.org webserver without 
entering a username and password. 


On November 3, 2009 another Scientology website, 
Freedom-Belgium.org which is hosted on the same webserver as 
Scientology-Europe.org, logged attempts to access another version 
of the C99shell program. These logs show that several of the IP 
addresses who accessed the C99Shell program are located in the 
United States. Scientology's headquarters is located in Los 
Angeles California. 
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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 12/14/2009 


To: San Antonio Attn: = 


From: Los Angeles 
CY-1 
Contact: 


Approved By: 
jp) 


Drafted By: 
288A-LA-254389 ‘vending | 


Case ID 


L INFORMATION CONTAINED 
EREIN IS UNCLASSIFIED 
ATE 06-l3-cOll BY 60322 UCLF/PLI/IN 


oer te 


Title: UNSUB(S) 
Church of Scientology - VICTIM 
Computer Intrusion 
00:LA 


Synopsis: To set a lead to San Antonio to search for wireless 
networks near the subject's address and provide a description of 
the location in anticipation of a search warrant. 


Details: During the period between October 31, 2009 and 
November 3, 2009 two Scientology websites, 
Scientology-Europe.org and Freedom-Belgium.org, were hacked, 
defaced, and ultimately redirected to the Anti-Scientology 
website Whyaretheydead.org. The websites were modified using a 
program called C99shell. This program was placed on the 
webserver without the website administrator's knowledge. A URL 
to access C99Shell was posted on the message board 888chan.org, a 
message board frequently used by the internet group Anonymous. 
This URL allowed any user who accessed the message board the 
ability to modify files on the webserver hosting both 
Scientology-Europe.org and Scientology-Europe.org without 
entering a username and password. 


Logs Church of Scientology identified 
the IP address as being involved in the 
defacement. § ena results from AT&T show this IP address is 


ubpo 
registered 2 Biographical information is as follows: 


UNCLASSIFIED 


UNCLASSIFIED 


To: San Antonio From: Los Angeles 
Re: 288A-LA-254389, 12/14/2009 


A criminal history check for reveals no prior 


arrests. 


Write San Antonio Agent conduct 
surveillance at using a wireless capable device 
and make note of the available wireless networks in and around the 


residence. Please note the name of the network as it appears on 
the device and whether or not the network is secured or available 
to the public. Also, please provide a description of the 
residence and if possible pictures in anticipation of a search 
warrant. 


UNCLASSIFIED 
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@ UNCLASSIFIED 


To: San Antonio From: Los Angeles 
Re: 288A-LA-254389, 12/14/2009 


LEAD (s): 
Set Lead 1: (Action) bé 


San Antonio 


a 


Writer requests that a San Antonio Agent conduct 
surveillance eae using a wireless capable device 
and make note of the available wireless networks in and around the 


residence. Please note the name of the network as it appears on 
the device and whether or not the network is secured or available 
to the public. Also, please provide a description of the 
residence and if possible pictures in anticipation of a search 
warrant. 


+4 


UNCLASSIFIED 


3 


288A- 7p 54389 — g 
JPM: jpn \ 


On January 15, 2010 writer researched IP address 
66.230.230.230, which was logged in the attack on Scientology's 
website. Writer determined this IP address is associated with 
spamming and a Tor Router, part of the TOR Anonymity Network. 
As such, no additional information can be obtained about the 
person who used this IP address in the attack. 


LL INFORMATION CONTAINED 


EREIN IS UNCLASSIFIED 


DATE 06-13-2011 BY 60322 UCLPYSPLUSIN 


FD-302 (Rev. 10-6-95) 


-l- 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 01/20/2010 


with the logy was interviewed 
telephonica phone number After being 
advised of the identity of the F ded the following 
information. 


Research conducted by the | Church of Seen O logy .] 


This posting is attached ina 1A envelope. 


[arse stated 888Chan.org is a website frequently used 
by the group Anonymous. The 888 stands for August 8,2008 and was 
the date of a large DDOS attach against the Church of Scientology. 


ALL INFORMATION CONTAINED 
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E 06-L3-2011 BY 60322 UCLPYPLISIN 


Investigation on 1/20/2010 at Los Angeles 
File # 288A-LA-254389 - 4 Date dictated 1/20/2010 


by SA | "\ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. / Xo 
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Pes 
FEDERAL BUREAU OF INVESTIGATION 


be 


Date of transcription 03/04/2010 Dee 


On Thursday, February 25, 2010, a physi j ce 
he residence located “{ 
ee aE The surveillance was conducte rom 
appLoximace : = 2: during which time sat 
Er and gay | obeerved the following: 


The residence is described as a two story, single family 
house with the exterior constructed of gray woo idi j white 
trim. The house is located on the south side a and 
the front of the house is facing northwest. Theré is a detached 
garage/building located several feet south of the house. The 
gara L1di is gray in color with two white garage doors that 
face There is a covered porch on the front of the 
house. e house has a composite roof. The house appears to be on 
a one to two acre lot that is enclosed by a wood privacy fence on 
the west side, a black wrought-iron fence and gate along the front, 
and a wire fence on the east side of the property. The gate which 
is located at the entrance to the driveway was closed. A keypad 


for the gate was observed on the driveway as was 
an address plaque that read Every several feet 
the wood and wrought-iron f y brick columns. 


The house sits approximately 100 yards from the road. Paved 
parking areas were observed in the front of the house, on the west 
side of the house (which is the area in front of the garage), and 
on the east side of the garage (which is the area behind the 
house). On the back of the house, eastern side, a deck area 
enclosed in wood lattice was observed. 


; Two vehicles were observed parked on the west side of the 
house. One vehicle was a white Chevrolet ort Utility 
Vehicle, bearing New Mexico license piate[ The other 

j wa j Chevrolet van, bearing Téxas license plate 
fd) S took nine digital photographs of the 
ce/property during this surveillance. 
Utilizing a wireless capable device, SA detected 
three secure wireless networks in the vicinity of 
acca One was 2wire262 utilizing 
7, One Was 2Wire utilizing channel four, and one was SATS5 


utilizing channel nine. 


Investigation on 02/25/2010 at San Antonio, TX 


\0 a 
File # 28 a Date dictated b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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288A-LA-254389 


Continuation of FD-302 of ,On 02/25/2010 _, Page 


A set of printed copies of the digital photographs and a 
CD containing the digital photographs are being maintained in the 
1A section of the case file. 


~ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/04/2010 


To: Los Angeles Attn: sf 
bé 
From: San Antonio bic 


Approved By: 


a CS 


Drafted By: 
Case ID #: 288A-LA-254389 eee 


| 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 06-13-2011 BY 60322 UCLP/SPLU/IN 


Title: UNSUB(S); 
CHURCH OF SCIENTOLOGY - VICTIM; 
COMPUTER INTRUSION; 
00: LA 


Synopsis: To cover lead one of serial seven. 


Reference: 288A-LA-254389 Serial 7 


Enclosure(s): 1) _FD-302 - Regarding surveillance conducted at 
| | on 

02/25/2010 a 

b6 

bic 
FD- 340 - Containing origi 
ucted at 
on 02/25 


3) FD-340 - Containing color printouts of nine 


digital photogr 
surveillance of 
[id on 0272572010, a CD containing 


these nine digital photographs, and two color 
printouts of satellite images of this property 
printed from the Internet (Bing) 


4) FD-340 - Containi intouts regarding Texas 
lice nd New Mexico license 
plat 

UNCLASSIFIED 


GCedAcCb902,e€Cc 
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UNCLASSIFIED 


To: Los Angeles From: San Antonio 
Re: 288A-LA-254389, 03/04/2010 


Details: Per xr io conducted 
surveillance a on 
02/25/2010. Writer utilized a wireless capable device which 


detected three secure wireless networks in the vicinity of this 
address. The house is located approximately 100 yards from the 
road and was enclosed by wood, wire, and wrought-iron fencing. A 
wrought-iron gate at the entrance of the driveway was closed 
denying access to the property. It is possible that a wireless 
device/network went undetected from the residence because of the 
distance the writer was from the house. 


Writer took Nine digital photographs of the 
residence/property. There were two vehicles located on the 
property. One vehicle was a white 2004 Chevrole 


Writer also accessed and printed two satellite images 
of this property from the Internet (Bing). 


San Antonio considers lead covered. 


UNCLASSIFIED 


2 


we 


To: Los Angeles From: San Antonio 
Re: 288A-LA~254389, 03/04/2010 


UNCLASSIFIED 


LEAD (s): 
Set Lead 1: (Info) 
LOS ANGELES 
AT LOS ANGELES, CALIFORNIA 


Read and clear. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 01/15/2010 


Scientology, 
work telephone 
Church of 
Los Angeles 
the agents, 


Scientology 
California. After being advise the identity o 
they presented the following information. 


vx further review of the server logs, 
ccessed the following pages on the 
website Scientology-Europe.org (Date/Time stamps may vary depending 
on which entry of the log used, as multiple entries are made for 
each visit to a webpage): 


Defaced Page: 3 times (November 1, 2009 19:36:19, 19:36:33 and “s 
19:36:38 ae 


Shell.php: 2 times (November 2, 2009 09:45:09 and 
November 2, 2009 09:45:39) 


SQL. php 1 time (November 2, 2009 09:47:06) 


[___eeatea he would provide writer via email with a 
detailed Iisting of damages associated with the attack. 


Server logs documenting the above access are in included 
in the attached 1A. 


b6 
b7C 


Investigation on 1/13/2010 at Los Angeles 
File # 288A-LA-254389 <~ [2 Date dictated 1/15/2010 


by SA jpm yy ?™ 
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it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 07/07/2009 
To: San Antonio Attn: SSA 
From: Los Angeles b6 
CyeL b7C 
Contact: 
Approved By: 
Drafted By: jpm oe 2, 
Case ID #: 288A-LA-254389 (Pending) ~ 
Title: UNSUB(S) ALL INFORMATION CONTAINED 
Church of Scientology - VICTIM HEREIN IS UNCLASSIFIED 
Computer Intrusion DATE 06-13-2011 BY 60322 UCLP/PLI/IN 
00: LA 
Synopsis: Request SAC concurrence for alto travel to San 
Antonio Division to conduct a subject in Ww. 
Administrative: Writer spoke with Ss ja telephone on b6 
July 7, 2010 regarding_this matter. SSA ag vide bIC 
S 


ssist § with said interview. a 
and SA covered previous lead (Serial 7) sent 
y writer to San Antonis. 


Details: Request SAC concurrence for sles travel to San 
Antonio Division to conduct a subject in Ww. 


During the period between October 31, 2009 and 
November 3, 2009 two Scientology websites, 
Scientology-Europe.org and Freedom-Belgium.org, were hacked, 
defaced, and ultimately redirected to the Anti-Scientology 
website Whyaretheydead.org. The websites were modified using a 
program called C99shell. This program was placed on the 
webserver without the website administrator's knowledge. A URL 
to access C99Shell was posted on the message board 888chan.org, a 
message board frequently used by the internet group Anonymous. 
This URL allowed any user who accessed the message board the 
ability to modify files on the webserver hosting both 


UNCLASSIFIED 


Diab - 25438 | - (D 


UNCLASSIFIED 


To: San Antonio From: Los Angeles 
Re: 288A-LA-254389, 07/07/2009 


Scientology-Europe.org and Scientology-Europe.org without bIC 
entering a username and password. 


by the Church of Scientology show IP 


address accessed files associated with the 
defacem ; esults from AT&T show this IP address is 


registered to Biographical information is as follows: 


| | A criminal history database inquiries were negative for 


Los Angeles requests SAC concurrence to 
travel to the San Antonio division to intervie 
determine his involvement with the website defacements described 
above. 


UNCLASSIFIED 
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UNCLASSIFIED 


To: San Antonio From: Los Angeles 
Re: 288A-LA-254389, 07/07/2009 


LEAD (s): 
Set Lead 1: (Action) 
SAN ANTONIO bre 
At SAN ANTONIO, TX 
Los Angeles requests SAC concurrence to 


travel to the San Antonio division to interview 


determine his involvement with the website defacements described 
above. 
+ 
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FEDERAL BUREAU OF INVESTIGATION 


cellular telephone nu 

ee ee NeonLo, ltexas was interviewed 
piace o usiness. er being advised of the identit 
interviewing agents, and the purpose of the interview, | 


provided the following information: 


ad 


a MOaar ave © TOMDUC G LL ; 3 5 31a 
himself a computer expert. frequently uses several operating 
systems including UNIX, LINUX7~anda Windows. 


has 


| nas approximately si puters at his residence, 
many of which are running ubuntu. [fuses Ubuntu because it is 
much more secure than Windows, an ourages everyone at his 
house to use Linux. 


fade familiar with the internet and message boards, 
but does Not visit them often. He has never heard of or visited 
bsite 888chan.org, or any of the other "chan" websi 
[Jas not familiar with the internet group anomywous. |_| 
as heard of the Church of Scientolog as not very 
knowledgeable about their practices. — dealt with a few 
computer viruses on his personal computers, but was not familiar 
with the term "malware" or a C99Shell. 
was then provided information by the interviewing 


agents that in October of 2009 an IP address associated with his 
residence accessed org. | fas related to a hack on the website 


i ology-Europe.org. had no knowledge of this access. 
[ |etstes the access cou ave occurred while someone was using 
rel rnet connection as it is not always secure. In 
adaition,| tated there have been ple who have lived 
at his re since October of 2009. lives in an "open" 


household and his son frequently has fri u ends of 
friends" live their for long periods of time. could not 
recall the names of all the individuals who h dat his 


residence, but after reviewing the contacts in his p 
rovided the following information about occupants of 
ry Since late 2009: 


Investigation on 10/13/2010 at San Antonio 
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Name ; 
Phone: 
Relati 
Notes: 


Currently resides at 


Name: 
Phone: 
Relation: 
Notes: Currently ut previously 
lived at and visit 

Name: 
Phone: 
Relation: 
Notes: Currently 


Name: 

Phone: 

Relation: Family friend 

Notes: Currently lives and goes to school in Austin TX. 


Name: 
Phone: 


Relation: Family frien 
Notes: No longer lives at 


Notes: No longer lives a 


Name: 
Phone: 


Relation: Family Frien 

Notes: No longer lives af | 
Phone: Urikniown 

Relation: Family Friend 

Notes: No longer lives at 


Name: 
Phone: Unknown 


wd ON 
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Continuation of FD-302 of On 10/13/2010 Page 3 


Relation: Family Friend 
Notes: No longer lives at Stole 
iple items from the house including jewelry and guns. 


ad no objections to the FBI speaking with his 
family or anyone who lived at his residence. He was also open to 
further questioning. 
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San 
Antonio Texas, telep was interviewed at 
his residence. After being advisé 


@ iagencity of 
interviewing agents, and the purpose of the interview 
provided the following information: 


and 
currently lives a e uses the 
internet con at this location to visit Facebook, Myspace, 
and veutobe (oo Jeeeeed he i very knowledgeable computer 
user, and that he uses Windows. was not familiar with the 


internet group ANONYMOUS, or the website 888chan.org. 


had no knowledge of and attack on the website 


org and had not heard_any of the other residents 
discuss the actack.[ [vas open to further 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 11/02/2010 
To: Los Angeles 
From: Los Angeles 


CY-3 
Contact: 


Approved By: 


Drafted By: ~ 
Case ID #: 288A-LA-254389 ALL THFORMATION CONTAINED 
i HEREIN Is UNCLASSIFIED 
Title: SCIENTOLOGY DATE 06-13-2011 BY 60322 UCLPSFLI/IN 
UNSUB (S) 


SCIENTOLOGY -VICTIM 
Synopsis: To close the above captioned case. 


Details: On October 31, 2009 the Scientology website 
Scientology-Europe.org was hacked, defaced, and ultimately 
redirected to the Anti-Scientology website Whyaretheydead.org. 
The Scientology-Europe.org website was modified using a program 
called C99shell. This program was placed on the webserver 
without the website administrator's knowledge. A URL to access 
c99Shell was posted on the messageboard 888chan.org, a message 
board frequently used by the internet group Anonymous. This URL 
allowed any user who accessed the messageboard the ability to 
modify files on the Scientology-Europe.org webserver without 
entering a username and password. 


On November 3, 2009 another Scientology website, 
Freedom-Belgium.org which is hosted on the same webserver as 
Scientology-Europe.org, logged attempts to access another version 
of the C99shell program. These logs show that several of the IP 
address that accessed the C99Shell program are located in the 
United States. Scientology's headquarters is located in Southern 
Disctrict of California. 


Further analysis of the IP logs provided by the Church of 
Scientology determined that all but one of the IP addresses 
located inside the United States that participated in the attack 
against the Church of Scientology utilized an anonymity program 


UNCLASSIFIED ors 5 0 kK 
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UNCLASSIFIED 


To: Los Angeles From: Los Angeles 
Re: 288A-LA-254389 , 11/02/2010 


such as TOR to mask their identity. No further investigation was 
conducted on these IP addresses. 


The sole IP address located in the U.S. tha 
the attack against the Church of Scientology was 
Subscriber information provi Communications sho 
j residence address 
ime of the attack. 


nd learned that in addition to 


writer interviewed 
[____]uhzee children and t least eight other individuals 
his residence during the time 
the individuals were college friends of] a af 
not provide their full contact inrtormation urth 
[Jetacea he often left his wireless router open for periods 
° ime so that anyone could access the internet through his 


connection. 


Writer requests the above titled case be closed due to lack 
of investigative leads. 
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